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Abstract — The purpose of this paper is to provide information 
to businesses interested in cloud computing. First we define 
cloud computing and discuss the different service and 
deployment models from a business standpoint. Then we move 
into business cases for the cloud and the strengths of each 
service and deployment model. We follow this up with business 
attributes that tend to drive a cloud adaption and the effects of 
cloud on business IT. The last section reveals the challenges 
of cloud computing ranging from security concerns and legal 
issues, to negotiation of an adequate service level agreement. 

Index Terms - cloud computing, cloud computing effects on 
business IT, cloud computing challenges 

I. Introduction to Cloud Computing 

A. Cloud Computing Defined 

Cloud Computing is a style (or method) of computing for 
which scalable and elastic IT capabilities are provided as a 
service to multiple customers via the Internet [8]. Simply 
stated, cloud computing enables third party cloud service 
providers to deliver computing components (such as CPU, 
disk space, RAM, bandwidth, operating systems, software 
etc.) as a rentable service rather than as a purchased product. 
The shared computing resources are provided to users like a 
utility where the user pays for the utilities used during a 
certain time period instead of a fixed price. 

The fundamental technology of cloud computing is a 
computer network and virtualization. Vrrtuahzation maximizes 
utilization of the underlying hardware and grants 
administrators the ability to create additional virtual machines 
when needed. This elasticity and flexibility is what gives 
clouds the capability to supply clients with resources as they 
need them. For the most part, cloud services implement server 
virtualization (virtual machines or VMs). Server virtualization 
partitions one physical server/computer into several virtual 
servers. This allows separate execution on each virtual 
machine and essentially separates them from the underlying 
hardware resources. In turn, this maximizes utilization of the 
underlying hardware and gives the cloud its elasticity and 
flexibility. 

B. Cloud Computing Types 

On top of the virtual platform there is a cloud business 
model and the software which allows implementation of the 
business model. This business model and the software allow 
cloud providers to monitor and charge only for resources 
which are used by their clients. Cloud providers typically 
break their services into three service models and four 
deployment models.. There are three types of computing 
service models: IaaS (Infrastructure as a Service), PaaS 
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(Platform as a Service) and SaaS (Software as a Service); and 
four main deployment models: public, community, private and 
hybrid. Each service and deployment model is described in 
the sub-sections that follow. Table 1 gives a summary of 
what each service model can provide for businesses. 

1. Cloud Computing Service Models. The three types of 
cloud computing service models are IaaS, PaaS and SaaS. 
Figure 1 depicts the hierarchal relationship between the 
various service models and describes the services, hardware 
and software provided by each [13]. 
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Fig. 1. Cloud Computing hierarchy 

Infrastructure as a Service (IaaS) provides underlying 
hardware and operating system resources. IaaS offers CPU, 
memory, storage, networking and security as a package [1]. 
Some current providers of IaaS can be seen in Table 1 . For 
IaaS, a cloud provider offers virtual hosted servers/machines 
to end-users on a "pay as you go" basis. You only pay for 
the servers needed to handle the traffic being experienced at 
that time. It is the IaaS provider's responsibility (such as 
GoGrid or Joyent) to provide their customers with the correct 
number of servers, and the correct amount of bandwidth to 
handle the load. 

For instance, during periods of high demand the cloud 
provider would increase a website's capacity to handle the 
high-volume traffic. During periods of low demand, the cloud 
provider would simply scale back the website's capabilities 
accordingly. The customer benefits by paying only for the 
resources used. This saves costs for the website owner and 
is one of the main selling points of cloud computing. Platform 
as a Service (PaaS) provides a development platform, thus is 
the service model most commonly used by software 
developers. Apre-made development platform relocates the 
upkeep and OS support services from the company to the 
cloud provider. The software developers would be able to 
build and test new applications on rented development or 
production infrastructures with no need to purchase these 
infrastructures. PaaS provides the customer with the 
hardware, operating system, software upgrades, security and 
everything else needed to support the day to day hosting of 
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an application [2] . Some examples of PaaS providers are shown 
in Table I. The cloud service most commonly used is Software 
as a Service (SaaS). It is currently the most popular type of 
cloud computing. The first SaaS providers were some of the 
Application Service Providers (ASPs) which appeared and 
became popular in the 1990s. SaaS is based on the concept 
of renting application functionality from a service provider 
rather than buying, installing and running the software on a 
personal computer. In theory, any software provided over 
the internet which has an underlying IaaS/PaaS infrastructure 
and is provided as a pay-as-you-use service would be 
classified as a SaaS offering. However, since many internet 
applications are free along with the fact that it is quite difficult 
to know on what infrastructure an internet application is 
running, pretty much any software offered over the Internet 
which runs remotely is classified as a SaaS offering [3]. The 
majority of SaaS offerings are either free (email) or 
subscriptions based, such as online collaboration and CRM 
(Customer Relationship Management: software applications 
that allow businesses to manage their relationship with a 
customer). 

2. Cloud Deployment Models. In addition to the three 
separate service models, there are also four different 
deployment models: public, community, private and hybrid. 
Public clouds allow the general public (or a large industry 
group) access to the cloud infrastructure. The infrastructure 
itself is owned by the cloud service provider. Public clouds 
are the least secure of the deployment models but usually 
come at a lower cost. Community clouds are shared by several 
organizations and support a specific community that has 
shared concerns, such as mission, security requirements, 
policy, or compliance considerations. It maybe managed by 
the organizations themselves or by a third party; and it may 
exist on-premise or off-premise. Private clouds are 
constructed for a single organization. It may be managed by 
the organization or a third party, and again, may exist on- 
premise or off-premise. Private clouds are typically the most 
secure deployment models but come at a higher cost. Lastly, 
hybrid clouds are composed of two or more clouds; such as 
a private cloud combined with a community or public cloud, 
but remain unique entities. The security and cost of a hybrid 
cloud deployment depends on its implementation. 
Any of the three service models mentioned in the previous 
section can be deployed as a public, community, private or 
hybrid cloud depending on how the cloud infrastructure is 
set up. 

II. Business Cases for Using a Cloud 

The following sections outline the advantages of the 
various cloud types and deployment models based on our 
research of existing company practices. Table 2 details a 
compilation of research to determine which cloud service/ 
deployment model businesses decided to implement based 
on their individual needs or restrictions. The company 
information gathered is current as of November 2011. As 
cloud technology expands in the future, company trends are 
likely to change.With cloud computing still in its early stages 
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of life, there is a lot of room for improvements and new 
developments. 

A. Deployment Models 

Businesses tend to gravitate towards the use of public 
clouds when growth is dynamic and cyclical. When 
businesses expect large spikes in their website traffic, or when 
they are looking for more economical solutions, public clouds 
are the preferred choice. Of course, when there is no privacy 
or sensitive data concern, public deployment is a great path 
to take due to its tendency to be cheaper than private 
deployment. 

Businesses seem more inclined to invest in a private cloud 
infrastructure when there is a need for high security, custom 
cloud configurations, or when more frequent interactions with 
the cloud-provider are desired - for example dealing with 
company proprietary information. The Cleveland Cavaliers 
chose to go with a private cloud to ensure one-on-one 
interaction with their cloud-provider [5]. On the other hand, 
the Orthopedic Institute decided to take advantage of a private 
cloud since they must comply with strict Health Insurance 
Portability and Accountability Act (HIPAA) rules for 
protecting patient information. Vrooman found that setting 
up a private cloud would make the most sense for them due 
to the fact that their website acts mainly as a traffic conduit 
[5]. 

When the network handles large amounts of continuous 
data transfers (terabytes) on a regular basis, a private cloud 
or no cloud at all might be the best options [4]. When Sony 
Pictures Image Works looked into cloud computing they came 
to the conclusion that if they did choose to rent out a cloud, 
they would need to use a private storage cloud. If they used 
a public cloud, the network bandwidth they would consume 
would be tremendous; between the range of 4 and 12 terabytes 
of data per employee every day. At that time, none of the 
public cloud providers could supply the company with that 
level of constant high-demand bandwidth. For this reason 
Sony Pictures decided to spend more effort on evaluating 
the possibility of a private storage cloud. [4] 

B. Service Models 

Our group conducted research to determine when 
businesses are more likely to rent an IaaS, PaaS or SaaS cloud 
computing infrastructure. After researching the benefits and 
downfalls to each infrastructure, the results have been 
compiled in Table II. The IaaS model is the best choice for 
legacy systems due to its configurability. Also, businesses 
with very specific software or OS needs supported by in- 
house programmers tended to go with IaaS. This allows them 
to create tailor-made software which is task specific. Also, 
businesses which see extreme fluctuations in usage seem to 
slightly prefer IaaS over PaaS. Businesses tend to select PaaS 
when they are not concerned about the intricate details of 
the operating system itself and are more concerned about 
the production of good, reliable software. Removing the 
burden of infrastructure upkeep and maintenance allows 
programmers to focus fully on developing new applications. 
Being able to rent a development/testing or production 
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infrastructure gives programmers great flexibility for software 
development. Businesses tend to use PaaS when the focus 
of their company is the software they produce and sell to 
others with a concentration on creating user friendly, multi- 
use, and multi-platform software. 

The SaaS service model is utilized in smaller businesses with 
a limited budget. SaaS gives businesses the freedom to never 
worry about security upgrades, software upgrades, hardware 
upgrades or any other headaches which can arise from having 
to maintain server and software. There are countless numbers 
of business tools being offered on the web for a monthly 
rate, removing the need to ever actually purchase the software 
or any of the software upgrades and support. In general, 
SaaS was found to be beneficial for businesses with limited 
or no IT department where the focus of their business is not 
computer or programming related. Lawyers, doctors, 
independent educators, marketing companies, construction 
businesses as well as many other small business operations 
all found benefit in taking advantage of SaaS cloud services. 
That is not to say large businesses could not benefit from 
using SaaS products, but that most of the time large 
businesses found the greatest benefit renting IaaS or PaaS. 
We found that SaaS was utilized by businesses whose main 
product is neither a software build nor a product dependent 
on software. SaaS is more commonly utilized as a tool to help 
with very typical everyday company tasks such as 
accounting, business, marketing, as well as many others. 

C. When Businesses Tend to Stay Away from Clouds 

In some scenarios, businesses ended up staying away from 
cloud computing all together. One of the main situations when 
cloud computing was not necessary is for very small business 
websites. Businesses such as GoDaddy, JustHost and 
MyHosting still hold the market when it comes to web hosting 
on a small scale. It is hard to compete with the low, fixed 
monthly rate web hosting these businesses are able to offer. 
Although it is possible that some web hosting businesses 
may dip their feet into offering web hosting using a "pay per 
use" cloud model and cloud hardware infrastructure, it seems 
somewhat improbable that this path would lead to lower 
pricing than the prices which already exist at web hosting 
sites. Another scenario where businesses tend to stay away 
from cloud computing is when a company works heavily with 
real-time data. When dealing with critical real-time data where 
significant latency times are not acceptable (for example in 
mission critical programs), many businesses decide to stick 
with the traditional methods of computing. This is one major 
area in which almost all businesses agree that the cloud is 
not suited to handle, as of today. One good example of low- 
latency critical applications can be seen in Wall Street stock 
companies. Also businesses who have little concern or need 
to stay current with the newest hardware/software tend to 
stay away from cloud computing. If all the work can be 
supported on a five to ten year old refurbished server with 
no need for the latest software applications, then it is very 
probable there are few cases which can be made for switching 
over to cloud services. 
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III. Adopting Cloud Computing and its Effects on 
Business IT 

Overall our research has lead us to hypothesize that there 
is no solid formula to determine when a business should or 
should not adopt cloud computing. However there were 
several trends that are present among those who did choose 
the cloud route. Inevitability there are also changes to IT 
that occur with cloud architecture. 

A. Adopting Cloud Computing 

Small start-up computing businesses were some of the 
major users of public cloud computing. The cloud offers a 
fast, easy, and cost efficient way to setup an IT infrastructure 
so they could focus on their new business development rather 
than IT operations. Also since start-ups are highly dynamic, 
it allows application developers to easily switch development 
environments or software configurations without huge 
hassles of purchasing new machines or licenses. 

For existing businesses the question of whether to adopt 
cloud computing becomes complicated. Most advocates of 
cloud computing support the architecture because of the 
potential cost savings. The trick is to find out exactly how to 
achieve those cost savings. Businesses have such a variety 
of cloud options to choose from (12 different service- 
deployment model combinations) that it can take a whole 
separate effort just to figure out what's the best service- 
deployment model. The driving factors are: what kind of 
service or data does a business deal with, what are the 
demands or constraints on this service or data, and what is 
the current state of their IT infrastructure. These questions 
are very in-depth on many levels and are not easily answered, 
especially for the larger well-established businesses. 

Those who adopt cloud computing are usually divided 
into two major groups. Most business either utilized the cloud 
for: 1. its quantity of cheap storage that can be allocated on 
the fly, or 2. for its elasticity in resources and computing 
power. Our research in Table 2 outlines what we consider the 
major business factors that tend to drive what kind of cloud 
service-deployment model they adopt. 

B. Effects of Cloud Adoption on Business IT 

Organizational IT inevitability changes with the adoption 
of cloud computing. The traditional notion of IT is that they 
are in charge of setup, maintenance, and configuration of all 
IT resources. This includes: networks, servers, databases, 
hardware, operating systems, software, end-user support, 
etc. With cloud computing, some of these responsibilities 
are moved to the cloud provider. What specific 
responsibilities will depend on the chosen service model 
(IaaS, PaaS, or SaaS). For example with SaaS, the responsibility 
of software licenses, upgrades, patches, installation and 
maintenance are all moved from the business IT to the SaaS 
cloud provider. However, business IT departments may pick 
up a few new responsibilities such as user support for cloud 
provider interfacing, or integration with legal. Since the cloud 
service is dictated by its contract, legal will need to work 
closely with IT subject matter experts to ensure proper service 
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Table I. Descriptions of Service Models 
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is contractually outlined [15]. In addition, auditing and 
tracking tasksmay become a prominent focus for IT. With 
business operations moving to the cloud, someone must 
manage what is dynamically created, stored, or used on the 
cloud. The cloud's ability to quickly allocate or de-allocate 
resources can become a nightmare for tracking. Some 
businesses are contractually required to reproduce data when 
asked, and since the cloud is so dynamic, it can be easy to 
accidently lose data when a VM gets de-allocated. It could 
even be possible to lose track of a VM entirely, and it ends up 
sitting somewhere on the cloud consuming costs and creating 
a potential security issue. Overall, with the adoption of cloud 
services we expect to see the IT department headcount 
decrease in the long run. Short term the IT personnel will be 
needed to organize the initial hand over, but long term there's 
less need for large IT departments since much of their 
responsibilities will migrate to the cloud providers. Thus the 
open IT job positions will most likely increase for cloud 
providers, but decrease for individual businesses. 
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IV. Challenges with Cloud Computing 

Although cloud computing can be very attractive in many 
ways, there are still challenges to keep in mind. The paper 
presented by Dillion et al [7] describes four main adoption 
challenges with cloud computing. These are: security, costing 
model, charging model, and the service level agreement. 
During our research we also found additional topics for 
discussion such as interoperability and legal issues. This 
list outlines some of the main questions for concern and is 
by no means comprehensive. 

A. Security 

Cloud computing security is probably one of the most 
important subjects to consider when deciding to utilize cloud 
computing. The fact is, data is stored on someone else's 
hardware, and that can be a serious risk if the data is highly 
sensitive. There could be issues of privacy, data loss, and 
even the physical security of the device. In addition, since 
cloud computing specializes in sharing resources, there could 
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be a chance business may be sharing the same physical 
machine with other, perhaps malicious, users. This brings to 
attention the topic of "reputation fate sharing", where your 
reputation is shared by the fate of all others also sharing the 
same physical resource [7]. Also, some may argue the fact 
that since the data is distributed across multiple locations 
(internally, and remotely on the cloud, which itself may include 
several locations), there are that many more opportunities 
and outlets for hackers to attack [9] . Instead of a single point 
of entry, the distribution has now created numerous points 
of entry, which all need to be secured and controlled. For 
data confidentiality, encryption has been suggested as a 
partial solution. An example would be to have the data 
encrypted locally before being stored on the cloud [9] . This, 
of course, creates more resource overhead. 

B. Costing Model 

Another hurdle with cloud computing is a costing model. 
While using cloud computing can reduce costs spent on 
servers and hardware, there can be additional unforeseen 
costs to consider. For one, the cost of data communication 
may increase [7] . Data transfer rates can increase depending 
on the cloud set-up and the type of data being transferred. 
This is especially true during the adoption period when a 
business initially moves their data to the cloud. Businesses 
that implement encryption security measures also have to 
consider the extra bandwidth required to transfer encrypted 
data and keys. Also, the processing power needed to 
constantly encrypt and decrypt data to and from the cloud 
would also cost resources. 

Additionally there is the cost of integrating company 
workstations to communicate with the cloud. Each cloud 
has its own interface and protocols for communication, thus 
the business will have to install the necessary software to 
interact with the cloud resources. This could range from a 
simple FTP program or web browser to custom licensed 
software. If a business is using multiple cloud computing 
providers, each provider may require unique software to 
interface with their system. This brings a new issue of 
interoperability into play, which will be addressed in detail 
later. 

C. Charging Model 

Developing a reasonable charging model can also be a 
challenge for inexperienced cloud users. A charging model is 
basically the contract you sign with the cloud provider which 
outlines charges for different services. A consumer of cloud 
computing should fully understand the charging model 
offered by the provider. It should incorporate all the dynamic 
usage of the cloud's resources. The type of resource will 
vary depending on the cloud computing service model, but 
some examples are: network usage, software licenses, data 
storage, etc. [7]. The charging model should also be 
customized to accommodate only the resources a business 
needs. This is,of course, one of the great benefits of using 
cloud architecture. Ideally a business should know exactly 
what kind of cloud service they need. This not only includes 



the amount of storage and servers needed, but qualities like 
robustness, security and integrity. Also note some qualities 
may not be as important as others. Say a business wants to 
use cloud services for storing a back-up copy of a trivial 
informational database. An example of trivial data would be 
product lists with descriptions, pricing, and other informa- 
tion readily known to the public. In this situation, the busi- 
ness would be focused on ensuring data integrity (having 
the data accurate and trusted), rather than data confidential- 
ity (only authorized users have access). 

Thus the business may not require a high level authenti- 
cation and authorization security protocols that for example 
a sensitive financial business might need. This level of 
customization might not be available by all providers, which 
is why it is important to sit down with the cloud provider and 
discuss available customization options before jumping into 
any final agreements [6]. Along the lines of a charging model, 
businesses may also want to look at what kinds of cost moni- 
toring tools cloud providers offer, if any. Businesses may 
need to closely monitor what's being charged to their ac- 
count not only for auditing purposes, but also to avoid end 
of the month billing surprises. For example, a developer at 
InformationWeek.com accidently left a resource hungry ap- 
plication running on their rented Amazon Web Services cloud. 
No one noticed until the bill went up tenfold at the end of the 
month [14]. 

D. Service Level Agreement 

The service level agreement (SLA) is the contract signed 
by both provider and consumer that guarantees aspects such 
as quality, availability, reliability and performance of resources 
[7] . This contract is especially important to a business, and 
the legality of drafting up such a document can be difficult. 
The SLA must be specific enough to cover the consumer's 
expectations but drafted in such a way for the components 
be measureable and verifiable. Since the SLA covers non- 
technical aspects this maybe challenging, but for businesses 
that deal with critical data, any downtime or outage could 
present serious obstacles and needs to be addressed. Thus 
businesses should also be sure to include scenarios in which 
they have the right to terminate the contract. For example, if 
a cloud provider consistently goes down or offline, busi- 
nesses should be able to cancel their contract instead of 
being locked in until the end of the year. On that note, any 
issues caused by unpredictable environmental disasters 
(power outages, hurricanes, etc) also need to be clearly out- 
lined in the contract [6] . 

E. Interoperability 

There may be a time when a business might consider 
using multiple cloud computing providers. Reasons for this 
may be security (don't put all your eggs in one basket) or 
just the scope of a provider. For example, as a business you 
may want to divide or replicate your sensitive data onto 
multiple clouds in case one was to fault or malfunction. 
Another example is a cloud provider that specializes in certain 
software as a service, but does not have adequate infra- 
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Table II. Company Tendencies On Deployment Models And Service Models For Certain Attributes That A Company May Have 
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structure to store large databases. Thus a business may need 
to enlist the help of a different cloud provider in order to host 
their databases. Whatever the reason for using multiple cloud 
providers, a business needs to be aware of the interoperability 
issues that come with multiple clouds. 

As cloud computing is still relatively new, there has not 
been much development in the way of standardized interfaces 
and protocols. Cloud provider may have different techniques 
for interfacing with their clouds. Because of this, businesses 
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that utilize multiple clouds will have to integrate each 
provider's unique interface into their work station. This could 
be costly depending on how complex the integration is, and 
how many workstations need to be integrated [7]. There is 
also the issue of portability when moving applications/data 
between clouds. Applications developed on one SaaS cloud 
provider may have custom configurations and tracking/ 
debugging data that may not be easily moved to a different 
SaaS provider [14]. Fortunately, organizations such as the 
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Open Cloud Computing Interface [10] and the Open Data 
Center Alliance [11] have been diligently working to develop 
standardizations. In the future this may be less of a problem, 
but as for now it is something to consider when using cloud 
computing [7]. 

Touching back on security, there's also the likelihood that 
each cloud provider has its own pre-defined levels of security, 
each uniquely implemented. Therefore, when using multiple 
cloud providers it's critical to be aware of the differences in 
their security policies. When specifying "data confidentiality" 
to one provider, they may give you 128-bit encryption, 
multiple authorization mechanisms, and permission control. 
But with another provider they may only do 64-bit encryption, 
two authorization mechanisms, and minimal permission 
control. The ultimate goal is to have all data residing at the 
same level of security assurance [12], which is not always 
easy to achieve when working with multiple parties. 

F. Legal Issues 

In addition to the above issues, there is another challenge 
presented by Lehman, et al [14]. Lehman brings attention to 
the legal issues with cloud computing. This mainly concerns 
businesses who utilize clouds in the public domain. To start, 
just data tracking and auditing within a cloud can be difficult. 
Businesses dealing with financial data are required to keep 
an audit trail [14]. With the data being located on a cloud 
service, businesses have to ensure the provider can offer 
sufficient tracking and auditing features to the level their 
policies dictate [22]. Secondly there's the issue of 
subcontracting. Some cloud providers may subcontract 
portions of their operations to other businesses. If a consumer 
plans to store sensitive or government data on the cloud, 
they would need to be legally notified of any sub-contractors. 
Although this breaks the transparency of cloud computing, 
it is important enough to warrant exposure. The customer 
also needs to understand cloud provider bankruptcy. There 
must be a clear understanding of what happens to the data 
should the cloud provider go bankrupt or become acquired 
by another company. Questions such as "what happens to 
the data legally?" and "is the data returned back to the 
customer?" need to be addressed before committing to a 
provider [22]. Lastly, there is the issue of data jurisdiction. If 
a business stores data on the cloud, the physical location of 
the data could fall within a different legal jurisdiction than 
the actual company. This is especially the case when cloud 
computing expands to a global scale. International 
cooperation would be needed to dictate between jurisdictions. 
In general, when using cloud resources, a business should 
be aware of the legal issues that come with crossing 
jurisdiction boundaries [14]. 

Conclusion 

Cloud computing provides various deployment methods and 
service styles which can be implemented in a variety of 
combinations. Each combination has unique benefits and 
advantages. Deciding on a type and how to utilize the cloud 
technology can be a difficult process for some businesses. 
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Implementing a cloud type unsuitable for a company could 
lead to increased company costs; whereas finding just the 
right fit could significantly decrease costs and relieve the 
company of some of the day to day headaches of server 
upkeep. We've assembled all our research into this one 
document with the main goal of helping businesses 
understand the world of cloud computing which they could 
then use to determine what cloud model would work best for 
their company. However keep in mind that despite the 
advantages of cloud computing, there are still several 
challenges that should be considered. These are, but not 
limited to: security, costing model, charging model, service 
level agreement, interoperability, and legal issues. Even 
businesses that are not interested in transferring to a cloud 
based computing system can still benefit from understanding 
the wide expanse it covers. Cloud computing continues to 
evolve and its use stretches to every corner of the Internet. 
Gradually it is changing the world of computing as we know 
it today. 
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